4.2 Compare Impact and No Impact for These Items 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the security impact of benign events on an organization's security posture?

   • AThey should be blocked to prevent potential threats.
   • BThey increase the risk of data loss because they generate false alerts.
   • CThey indicate a potential compromise that requires immediate investigation.
   • DThey have no direct security impact but can affect monitoring efficiency by consuming resources.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing a security event where an attacker exploited a vulnerability in a web application and stole customer credentials. The intrusion detection system generated an alert for the exploit. Which classification best describes the security event's impact?

   • AImpact because the event caused harm and compromise
   • BImpact only if the alert was a false positive
   • CNo impact because the alert was generated
   • DNo impact because the attack was detected
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the context of network security monitoring, what does the term 'benign' mean?

   • AActivity that is malicious but not detected.
   • BActivity that is blocked by security controls.
   • CActivity that is normal and non-malicious.
   • DActivity that is suspicious but not yet confirmed.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team has been running a new intrusion detection system for a month. During this period, it correctly alerted on two real malware infections and remained silent when no malicious activity occurred. How do these outcomes affect the team's confidence in the monitoring system?

   • AThey build trust because the system correctly identified real threats and did not generate false alarms
   • BThey have no effect on trust because alerts are always investigated
   • CThey increase workload because every alert must be verified
   • DThey reduce trust because the system is too quiet
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations center has a monitoring system that produces a high number of true positives and true negatives. However, the team is concerned that the system may be missing some attacks (false negatives) and is considering whether to adjust the system to catch more threats. Which consideration is most important when deciding whether to adjust the system?

   • AThe number of true negatives the system produces
   • BThe cost of the monitoring system
   • CThe size of the security operations center team
   • DThe potential increase in false positives and their operational impact
   Reveal Solution Discussion Select an answer first